Wisayo Privacy Policy
1. Introduction
Wisayo ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains our data practices for the Wisayo app and website.
2. Information We Collect
2.1 Information You Provide
- Account creation: Email address and subscription tier
- Profile data: Name, birthday, gender, and lifestyle survey responses (optional) — stored only on your device
- Key Person data: Name, birthday, gender, and relationship role of people you add — stored only on your device
- Communications: Chat history, saved guidance, and daily insights — stored only on your device
- Support: Messages you send to our support team
- Payment: payments are processed by Dodo, our payment processor (we never store full credit card details)
2.2 Information Collected Automatically
- Device information: Device type, operating system, and app version
- Usage analytics (anonymized): How often features are used — never what content you create
- Crash reports: Technical error data used to improve the app
- Ad delivery: Google Ad Manager collects data to serve rewarded video ads (see Section 4: Advertising)
For details on the third-party providers we use for analytics, crash reporting, and other processing (including Sentry and PostHog), see Section 10.
2.3 Information We Do NOT Collect or Store
- We do NOT store your profile data on our servers
- We do NOT store Key Person data on our servers
- We do NOT store your daily insights or chat history on our servers
- We do NOT read your personal vault contents
- We do NOT sell your data to third parties
- We do NOT build ad-targeting profiles based on your in-app activity
- We do NOT train AI models on your in-app activity
3. How We Use Your Information
We use the information we collect to:
- Provide and improve the Wisayo service
- Authenticate your account and manage your subscription
- Send transactional emails (receipts, password resets, critical updates)
- Troubleshoot technical issues
- Comply with legal obligations
- Understand feature usage in aggregate, anonymized form
We do NOT use your information to:
- Build advertising profiles
- Sell to third parties or share with data brokers
- Train AI models on your personal data
- Market to you based on your vault contents
4. Advertising & Rewarded Videos
4.1 Google Ad Manager
The Free plan includes rewarded video ads served by Google Ad Manager. Watching videos grants daily insight and chat allowance.
4.2 Ad-Related Data Collection
Google Ad Manager may collect:
- Device identifiers (for ad serving)
- General location data (country/region level)
- Ad interaction data (which ads were displayed)
- Device type and OS
We don't use personalized ads.
4.3 Ad Transparency
We do NOT provide Google with:
- Your chat contents or daily insights
- Your personal information
- Information from your vault
We DO provide Google with:
- That you're a Free plan user
- General engagement metrics (ads viewed, completed)
See Google's Privacy Policy: policies.google.com/privacy
5. Data Storage & Security
5.1 Local Encryption
- Your vault contents are encrypted on your device
- Encryption key is stored locally (never sent to us)
- Unencrypted vault data never leaves your device
5.2 Server Security
- Account data encrypted in transit (TLS/HTTPS)
- Data encrypted at rest on our servers
- Regular security audits and penetration testing
- Compliance with GDPR, CCPA, SOC 2 standards
5.3 Multi-Device Sync
- Encrypted sync between active device and server backup
- Read-only devices cannot modify data
- Automatic encryption during transfer
6. Your Rights & Choices
6.1 Access & Portability
You can request all personal data we hold about you. We'll provide it within 30 days.
6.2 Deletion
Request account deletion anytime. Your vault stays on your device. We delete:
- Your account record
- Stored device registration info
- Sync backup (if you choose)
6.3 Withdrawal of Consent
You can withdraw consent for data processing anytime via account settings.
6.4 Do Not Track
We respect browser "Do Not Track" signals for analytics (if applicable).
7. Retention Policy
We retain your data only as long as your account is active:
- Active accounts: All data retained
- Inactive accounts (no login 12+ months): Automated deletion notice sent
- Deleted accounts: All server-side data deleted within 30 days
Your vault data on your device is retained until you manually delete it.
8. Children's Privacy
Wisayo is not intended for use by children under the age of 18. The Service automatically blocks the creation or use of any user profile indicating an age under 18 and will not function for such profiles.
Limited Exception for Parental Use
On the Unlimited plan only, an account owner (who must be a parent or legal guardian) may create a "Key Person" profile for a minor under 18 solely for the parent's own use in receiving parenting guidance. Minors themselves are not permitted to access or use the Service under any circumstances. These Key Person profiles are created and controlled exclusively by the parent or legal guardian.
Parents or legal guardians may request the deletion of their child's Key Person profile and all associated data at any time by contacting us.
COPPA Compliance
We do not knowingly collect, use, or disclose personal information from children under the age of 13 without verifiable parental consent, in accordance with the Children's Online Privacy Protection Act (COPPA) and other applicable children's privacy laws (including GDPR Article 8 where relevant). If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete such information as quickly as possible.
9. International Data Transfers
Your profile data, Key Person data, daily insights, chat history, and saved guidance are encrypted and stored locally on your device — they are never transferred to our servers (see Section 2.3).
We store limited account data — your email address, subscription tier, and support correspondence — on servers located in Frankfurt, Germany. For users accessing Wisayo from outside the European Union, this account data is processed on our EU-based servers.
Wisayo is operated from Israel. Where our team accesses account data stored on our EU servers, this transfer is covered by the European Commission's adequacy decision for Israel, which recognizes Israel as providing an adequate level of data protection.
Some third-party providers we work with may process data outside your region:
- Dodo may process payment, billing, tax, receipt, and transaction-support data when you subscribe to a paid plan
- Google Ad Manager processes ad-delivery data as described in Section 4
Where personal data is transferred outside the EU, we rely on GDPR Standard Contractual Clauses, adequacy decisions, or other approved safeguards. We work with vendors that provide GDPR- and CCPA-compliant data processing agreements, and we comply with the CCPA for California residents.
10. Third-Party Services
We use the following vendors, all of which are GDPR and CCPA compliant:
- Dodo — Payment processing, billing, taxes, receipts, and transaction support for paid plans
- Google Ad Manager — Ad delivery (Free plan only)
- Sentry — Error monitoring & crash reports (anonymized technical crash data)
- PostHog — Analytics (anonymized, aggregated)
- DigitalOcean — Cloud hosting & database storage (account data: email, subscription tier)
Each vendor operates under its own privacy policy — links are provided by the vendor directly.
11. Policy Changes
We may update this policy from time to time to reflect legal changes or service improvements. Material changes will be communicated to you by email before they take effect.
12. Contact Us
Have privacy questions? Contact us:
- Email: security@wisayo.com
- Support: wisayo.com/support
- Mailing address: 26 HaHatzav Street, Or Yehuda, Israel
To submit a formal data request (GDPR/CCPA):
- Email security@wisayo.com with the subject line "Data Request"
- We will respond within 30 days, as required by law